I want to see any failed job, ad-hoc and scheduled. For instance, I was creating a new search command, and it failed a lot until I got it right. I expect to see the same error, I see in web search, in the logs:
Use the Job Inspector.
https://docs.splunk.com/Documentation/Splunk/8.2.1/Search/ViewsearchjobpropertieswiththeJobInspector
After posting, I ended up with this:
| rest /servicesNS/-/-/search/jobs
| eval t=strptime(updated, "%Y-%m-%dT%H:%M:%S.%f-%z")
| where
[ makeresults
| addinfo
| eval search=" t >= ". info_min_time. if(info_max_time=="+Infinity",""," AND t <= ".info_max_time) ]
| eval hadError=case(isFailed=1, 1, isNotNull('messages.error'), 1, 1=1, 0)
| search hadError=1
| stats count